DOCSLIB.ORG

Modern Password Security for Users User-Focused Recommendations for Creating and Storing Passwords

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Modern Password Security for Users User-Focused Recommendations for Creating and Storing Passwords Modern password security for users User-focused recommendations for creating and storing passwords By Ian Maddox and Kyle Moschetto, Google Cloud Solutions Architects This guide describes password guidance and recommendations for users of online applications that require authentication. It establishes a set of user-focused recommendations for creating and storing passwords, including balancing password strength and usability. A related guide, Modern password security for system ​ designers, offers guidance for the engineers who build online applications that require authentication. ​ The technology world has been trying to improve on the password since the early days of computing. Shared-knowledge authentication is problematic, because information can fall into the wrong hands or be forgotten. The problem is magnified by systems that don't support real-world secure use cases and by the all-too-common decision of end users to take shortcuts. Best practices quick reference DO DON’T Use a password manager. Write down your passwords or store them unencrypted. Use unique passwords for every site and application. Reuse passwords on multiple sites. Make long, random passwords. Use short passwords or obvious character substitutions (such as @ for a). Use multi-word passphrases. Use single dictionary words (such as “password”). Use salted passphrases or algorithms for security Answer security questions honestly. questions. Trust and review authoritative sources for best Think personal web security practices you learned 10 practices. years ago still apply. Overview This document outlines the following: ● Trusted sources of thoughtful and researched information about password security ● Recommendations for safely handling end-user passwords ● Common anti-patterns and myths around password security ● Additional technologies to explore Modern password security for users Terminology entropy Related to passwords, a measurement of how unpredictable a password is. Commonly represented as a number of bits. hash In cryptography, a hash is the result of one-way, irreversible, deterministic encryption algorithm. It is mathematically extremely hard to guess the value that was used to create a hash. Similarly it is extremely unlikely to find two values that produce the same hash. Because a hashing algorithm will always produce the same hash for a given input, hashes can be used as secure stand-ins for sensitive data such as passwords. Login attempts can be authenticated by hashing the provided password and comparing it to the hash on file. MFA and 2FA Multi-factor authentication and two-factor authentication. Methods for additional verification, ​ traditionally in addition to a password. password manager Software that assists in creating, storing, and retrieving passwords. rainbow table A systematically generated table of precomputed hashes and their pre-hashed values. Commonly used to match a hash to a password or passphrase. salt Random data added to an input, usually used to produce a non-predictable variant hash of the original input and to break rainbow tables When to use this guide This document covers many of the options for using passwords to control access to resources in the cloud-native world. This document does not attempt to provide all of the answers, nor to provide specific solutions. The goal is merely to raise awareness among end users, security professionals, system designers, and cloud architects. An overview of passwords in 2019 The topic of password security seemingly contains as many strong opinions as there are possible passwords. Organizations draw different lines between what behaviors are secure and those that they consider insecure. This document does not intend to provide definitive guidance on password use in every application, but instead to outline a collection of topics that all users and engineers should consider Ian Maddox and Kyle Moschetto Page 2 Google Cloud Solutions Architects Modern password security for users whenever they use or design password-based systems. Each application will have a unique security posture consistent with the sensitivity of the data protected by the application. Passwords are in use everywhere. They remain the most common authentication mechanism, and are used across every vertical, industry, and application type. Unlike other common security features, passwords stand alone in that the industry is still debating how they should be implemented, managed, and stored. The main reason for this lack of agreement is that the world of security evolves quickly. What we find secure today might be considered deprecated, compromised, broken, or simply out of date tomorrow. The things we feel are cutting edge now won't be for long as new technology, tools, and procedures supersede them. Users and systems designers must stay knowledgeable about the trends and changes in the world of password security. Authoritative sources There are a number of trusted sources for the latest guidance on the use of passwords. The following list is far from exhaustive, but represents highly regarded opinions on the matter: ● The National Institute of Standards and Technology (NIST) is part of the US Department of ​ ​ Commerce and provides guidance in many areas. Their Digital Identity Guidelines (SP 800-63) cover ​ ​ a range of password-related topics. ● The National Cyber Security Centre (NCSC) is the UK’s independent authority on cybersecurity. They ​ ​ provide guidance in many areas, including password security. ​ ​ ​ ​ ● The Open Web Application Security Project (OWASP) is a worldwide not-for-profit organization ​ ​ focused on improving the security of software. Their collection of documentation available on GitHub ​ ​ includes cheatsheets on authentication, password storage, and more. ​ ​ ​ ​ ● Google provides beginner documentation on creating strong passwords, making your Google account ​ ​ ​ more secure, managing your passwords, and the 12 best practices for user account, authorization ​ ​ ​ ​ ​ and password management. ​ Ian Maddox and Kyle Moschetto Page 3 Google Cloud Solutions Architects Modern password security for users Password considerations for users Because every member of an online community has to use a password at some point, understanding password care from a user perspective is a great place to start. Creating passwords When you create passwords, you have two primary concerns: the length and strength of your passwords, and the operational security of your passwords. The following sections discuss these concerns. Length and strength At its most basic level, the use of a password is designed to prevent an unauthorized person or device from accessing a resource. Prevention means making it mathematically difficult to guess your password. How this difficulty is measured is called password entropy. Put simply, entropy is a measure of complexity and ​ ​ randomness. This number is measured in bits. Entropy calculation Although there are a few competing ideas of how to calculate true password entropy, one simple example is the following formula: password length × log2(possible characters) = password entropy ​ ​ ​ ​ ​ ​ By taking the log2 of the number of characters available and multiplying it by the character length of the ​ ​ password, you can calculate the number of bits of password entropy. The more bits of entropy that your password has, the more difficult it is for a computer to guess, predict, or successfully attack it by brute force. Each bit of entropy mathematically doubles the difficulty of guessing the password correctly. For 28 example, 28 bits of entropy represents 2 ​ or 268,435,456 possible passwords. A password that consists of ​ lowercase English letters (26 characters in the set), and is 6 characters in length, has ~28 bits of entropy. Table 1 illustrates the rapid growth of password complexity. The dictionary column on the right represents whole words chosen from the Oxford English Dictionary instead of individual characters. ​ ​ Ian Maddox and Kyle Moschetto Page 4 Google Cloud Solutions Architects Modern password security for users a–z, A–Z, a–z, A–Z, 0–9, Charset a–z a–z, A–Z Full UTF-8 Dictionary 0–9 symbols Charset 26 52 62 95 137,000 171,476 words size Chars/ Bits of entropy words 4 19 23 24 26 68 70 6 28 34 36 39 102 104 8 38 46 48 53 137 139 12 56 68 71 79 205 209 16 75 91 95 105 273 278 32 150 182 191 210 546 556 60 282 342 357 394 1,024 1,043 Table 1. Growth of entropy in password complexity ​ Dictionary words and passphrases If you have a dictionary like the Oxford English Dictionary with 171,476 headword entries (for words in ​ ​ current use), then that’s the size of your "character" set. If you choose one word, that’s the equivalent of choosing a single character password from a 171,476-character alphabet. Using the preceding formula, a password based on a single dictionary word has: 1 x log2(171,476) = 17 bits of entropy ​ ​ By increasing the length of the password to 4 words (that is, by creating a 4-word passphrase), you get 70 bits of entropy. This level of entropy is mathematically very good as long as you aren’t up against a quantum computer. Table 2 illustrates that this passphrase would take up to 2.7 million years to guess. Compromised passwords and rainbow tables Because passwords are normally stored as hashes in password databases, having a large list of known password-to-hash values can be extremely valuable to a password hacker. If a hacker obtains your hashed password and that hash matches a known password-to-hash value, then the hacker knows your password. Collections of these password-to-hash values are known as rainbow tables. These tables are used like a ​ ​ reverse directory of hashes to passwords. The values hashed in rainbow tables are generated through several methods. Two basic approaches are 1) to generate every possible combination of characters for a given charset, or 2) to gather a list of previously stolen passwords. In the second case, when the list of passwords is obtained, each entry is hashed and the Ian Maddox and Kyle Moschetto Page 5 Google Cloud Solutions Architects Modern password security for users hash result is stored next to the plaintext password in the rainbow table.
Load more

Recommended publications
  • Google Docs Accessibility (Pdf)
    Google Docs Accessibility (A11y) Building Accessible Google Docs • Heading Styles • Images • Table of Contents • Captioning • Columns and Lists • Tables A11y • Tab Stops • Color Contrast • Paragraph Spacing • Headers and Footers • Meaningful Link Text • Accessibility Checker What is Assistive Technology? Assistive Technology (AT) are “products, equipment, and systems that enhance learning, working, and daily living for persons with disabilities.” Magnification Speech Screen Readers Software Recognition Trackball Mouse Keyboard Zoom Text Braille Computer Keyboard Captions/Subtitles Captioned Telephone Video Relay Services Captioning Videos Per federal and state law, and CSU policy, instructional media (e.g., videos, captured lectures, recorded presentations) must have captions. This includes instructional media used in classrooms, posted on websites or shared in Canvas. • All students who are enrolled in a course must be able to access the content in the course. • Faculty: Funding is available to help faculty generate captions and transcripts for instructional media. Materials should be submitted at least six weeks in advance of their use in instruction. • Staff: For CSUN staff who do not provide classroom material, there is a cost through chargeback. For information on the chargeback, email [email protected]. csun.edu/captioning What are Screen Readers Screen readers are a form of assistive technology (AT) software that enables access to a computer, and all the things a computer does, by attempting to identify and interpret what is being displayed on the computer screen using text-to-speech. Screen readers can only access and process live text (fully editable or selectable text). • Provides access to someone who is visually impaired, mobility or has a learning disability to access text on the screen.
    [Show full text]
  • Argon and Argon2
    Argon and Argon2 Designers: Alex Biryukov, Daniel Dinu, and Dmitry Khovratovich University of Luxembourg, Luxembourg [email protected], [email protected], [email protected] https://www.cryptolux.org/index.php/Password https://github.com/khovratovich/Argon https://github.com/khovratovich/Argon2 Version 1.1 of Argon Version 1.0 of Argon2 31th January, 2015 Contents 1 Introduction 3 2 Argon 5 2.1 Specification . 5 2.1.1 Input . 5 2.1.2 SubGroups . 6 2.1.3 ShuffleSlices . 7 2.2 Recommended parameters . 8 2.3 Security claims . 8 2.4 Features . 9 2.4.1 Main features . 9 2.4.2 Server relief . 10 2.4.3 Client-independent update . 10 2.4.4 Possible future extensions . 10 2.5 Security analysis . 10 2.5.1 Avalanche properties . 10 2.5.2 Invariants . 11 2.5.3 Collision and preimage attacks . 11 2.5.4 Tradeoff attacks . 11 2.6 Design rationale . 14 2.6.1 SubGroups . 14 2.6.2 ShuffleSlices . 16 2.6.3 Permutation ...................................... 16 2.6.4 No weakness,F no patents . 16 2.7 Tweaks . 17 2.8 Efficiency analysis . 17 2.8.1 Modern x86/x64 architecture . 17 2.8.2 Older CPU . 17 2.8.3 Other architectures . 17 3 Argon2 19 3.1 Specification . 19 3.1.1 Inputs . 19 3.1.2 Operation . 20 3.1.3 Indexing . 20 3.1.4 Compression function G ................................. 21 3.2 Features . 22 3.2.1 Available features . 22 3.2.2 Server relief . 23 3.2.3 Client-independent update .
    [Show full text]
  • CPAS04 Authenticator Options Version 1.0 11 November 2015
    GSM Association Non-confidential Official Document PDATA.03 - CPAS04 Authenticator Options CPAS04 Authenticator Options Version 1.0 11 November 2015 This is a Non-binding Permanent Reference Document of the GSMA Security Classification: Non-confidential Access to and distribution of this document is restricted to the persons permitted by the security classification. This document is confidential to the Association and is subject to copyright protection. This document is to be used only for the purposes for which it has been supplied and information contained in it must not be disclosed or in any other way made available, in whole or in part, to persons other than those permitted under the security classification without the prior written approval of the Association. Copyright Notice Copyright © 2016 GSM Association Disclaimer The GSM Association (“Association”) makes no representation, warranty or undertaking (express or implied) with respect to and does not accept any responsibility for, and hereby disclaims liability for the accuracy or completeness or timeliness of the information contained in this document. The information contained in this document may be subject to change without prior notice. Antitrust Notice The information contain herein is in full compliance with the GSM Association’s antitrust compliance policy. V1.0 Page 1 of 38 GSM Association Non-confidential Official Document PDATA.03 - CPAS04 Authenticator Options Table of Contents 1 Introduction 3 1.1 Overview 3 1.2 Scope 3 1.3 Abbreviations 3 1.4 References 5 2 Level
    [Show full text]
  • NSA Vs. Encryption Article Written by Datto Developer Dan Fuhry First Appeared on Mspmentor.Com in November 2013
    SuccessArticle: EncryptionStory NSA vs. Encryption Article written by Datto developer Dan Fuhry first appeared on MSPmentor.com in November 2013. If you’ve been watching the news lately, there is no doubt you have heard about the National Security Agency’s (NSA) surveillance scandal. “We will stand in our firm Recent months have seen a revelation of programs commitment to protect you and that capture domestic and international traffic indiscriminately. Encrypted data gets saved for a your customers.” certain number of years, in case they ever decide to decrypt it. If this alarms you, that’s good. You should be alarmed. I was too, on a very personal level, and have actively been working on changing some long-established habits in order to protect the information that is private and personal to me. For MSPs not in the United States you should be even more alarmed. It’s not even your own government that has the encrypted data, and since you don’t have constitutional protection in the U.S., there is nothing legally standing in the NSA’s way to prevent them from using their dark magical cryptographic powers to obtain your confidential business or personal data. This is a frightening proposition indeed, which is why I want to talk about the position Datto has taken regarding the recent revelations. Before we go any further, allow me to briefly describe my role here. I’m a developer with Datto, and I designed the encryption feature for Datto SIRIS. I picked the ciphers, hash algorithm parameters, and random number generator algorithm, had them peer-reviewed, and then wrote the code.
    [Show full text]
  • Intro to Cryptography 1 Introduction 2 Secure Password Manager
    Programming Assignment 1 Winter 2021 CS 255: Intro to Cryptography Prof. Dan Boneh Due Monday, Feb. 8, 11:59pm 1 Introduction In many software systems today, the primary weakness often lies in the user’s password. This is especially apparent in light of recent security breaches that have highlighted some of the weak passwords people commonly use (e.g., 123456 or password). It is very important, then, that users choose strong passwords (or “passphrases”) to secure their accounts, but strong passwords can be long and unwieldy. Even more problematic, the user generally has many different services that use password authentication, and as a result, the user has to recall many different passwords. One way for users to address this problem is to use a password manager, such as LastPass and KeePass. Password managers make it very convenient for users to use a unique, strong password for each service that requires password authentication. However, given the sensitivity of the data contained in the password manager, it takes considerable care to store the information securely. In this assignment, you will be writing a secure and efficient password manager. In your implemen- tation, you will make use of various cryptographic primitives we have discussed in class—notably, authenticated encryption and collision-resistant hash functions. Because it is ill-advised to imple- ment your own primitives in cryptography, you should use an established library: in this case, the Stanford Javascript Crypto Library (SJCL). We will provide starter code that contains a basic tem- plate, which you will be able to fill in to satisfy the functionality and security properties described below.
    [Show full text]
  • Analysis of Password Cracking Methods & Applications
    The University of Akron IdeaExchange@UAkron The Dr. Gary B. and Pamela S. Williams Honors Honors Research Projects College Spring 2015 Analysis of Password Cracking Methods & Applications John A. Chester The University Of Akron, [email protected] Please take a moment to share how this work helps you through this survey. Your feedback will be important as we plan further development of our repository. Follow this and additional works at: http://ideaexchange.uakron.edu/honors_research_projects Part of the Information Security Commons Recommended Citation Chester, John A., "Analysis of Password Cracking Methods & Applications" (2015). Honors Research Projects. 7. http://ideaexchange.uakron.edu/honors_research_projects/7 This Honors Research Project is brought to you for free and open access by The Dr. Gary B. and Pamela S. Williams Honors College at IdeaExchange@UAkron, the institutional repository of The nivU ersity of Akron in Akron, Ohio, USA. It has been accepted for inclusion in Honors Research Projects by an authorized administrator of IdeaExchange@UAkron. For more information, please contact [email protected], [email protected]. Analysis of Password Cracking Methods & Applications John A. Chester The University of Akron Abstract -- This project examines the nature of password cracking and modern applications. Several applications for different platforms are studied. Different methods of cracking are explained, including dictionary attack, brute force, and rainbow tables. Password cracking across different mediums is examined. Hashing and how it affects password cracking is discussed. An implementation of two hash-based password cracking algorithms is developed, along with experimental results of their efficiency. I. Introduction Password cracking is the process of either guessing or recovering a password from stored locations or from a data transmission system [1].
    [Show full text]
  • User Authentication and Cryptographic Primitives
    User Authentication and Cryptographic Primitives Brad Karp UCL Computer Science CS GZ03 / M030 16th November 2016 Outline • Authenticating users – Local users: hashed passwords – Remote users: s/key – Unexpected covert channel: the Tenex password- guessing attack • Symmetric-key-cryptography • Public-key cryptography usage model • RSA algorithm for public-key cryptography – Number theory background – Algorithm definition 2 Dictionary Attack on Hashed Password Databases • Suppose hacker obtains copy of password file (until recently, world-readable on UNIX) • Compute H(x) for 50K common words • String compare resulting hashed words against passwords in file • Learn all users’ passwords that are common English words after only 50K computations of H(x)! • Same hashed dictionary works on all password files in world! 3 Salted Password Hashes • Generate a random string of bytes, r • For user password x, store [H(r,x), r] in password file • Result: same password produces different result on every machine – So must see password file before can hash dictionary – …and single hashed dictionary won’t work for multiple hosts • Modern UNIX: password hashes salted; hashed password database readable only by root 4 Salted Password Hashes • Generate a random string of bytes, r Dictionary• For user password attack still x, store possible [H(r,x after), r] in attacker seespassword password file file! Users• Result: should same pick password passwords produces that different aren’t result close to ondictionary every machine words. – So must see password file
    [Show full text]
  • Modern Password Security for System Designers What to Consider When Building a Password-Based Authentication System
    Modern password security for system designers What to consider when building a password-based authentication system By Ian Maddox and Kyle Moschetto, Google Cloud Solutions Architects This whitepaper describes and models modern password guidance and recommendations for the designers and engineers who create secure online applications. A related whitepaper, Password security ​ for users, offers guidance for end users. This whitepaper covers the wide range of options to consider ​ when building a password-based authentication system. It also establishes a set of user-focused recommendations for password policies and storage, including the balance of password strength and usability. The technology world has been trying to improve on the password since the early days of computing. Shared-knowledge authentication is problematic because information can fall into the wrong hands or be forgotten. The problem is magnified by systems that don't support real-world secure use cases and by the frequent decision of users to take shortcuts. According to a 2019 Yubico/Ponemon study, 69 percent of respondents admit to sharing passwords with ​ ​ their colleagues to access accounts. More than half of respondents (51 percent) reuse an average of five passwords across their business and personal accounts. Furthermore, two-factor authentication is not widely used, even though it adds protection beyond a username and password. Of the respondents, 67 percent don’t use any form of two-factor authentication in their personal life, and 55 percent don’t use it at work. Password systems often allow, or even encourage, users to use insecure passwords. Systems that allow only single-factor credentials and that implement ineffective security policies add to the problem.
    [Show full text]
  • Profiles Research Networking Software Installation Guide
    Profiles Research Networking Software Installation Guide Documentation Version : July 25, 2014 Software Version : ProfilesRNS_2.1.0 Table of Contents Introduction ..................................................................................................................... 2 Hardware and Operating System Requirements ............................................................. 3 Download Options ........................................................................................................... 4 Installing the Database .................................................................................................... 5 Loading Person Data....................................................................................................... 8 Loading Person Data: Part 1 – Importing SSIS Packages into SQL Server msdb Database ..................................................................................................................... 8 Loading Person Data: Part 2 – Importing Demographic Data .................................... 10 Loading Person Data: Part 3 – Geocoding ................................................................ 15 Loading Person Data: Part 4 – Obtaining Publications .............................................. 16 Loading Person Data: Part 5 – Convert data to RDF ................................................. 19 Scheduling Database Jobs ............................................................................................ 21 Installing the Code........................................................................................................
    [Show full text]
  • To Change Your Ud Password(S)
    TO CHANGE YOUR UD PASSWORD(S) The MyCampus portal allows the user a single-signon for campus applications. IMPORTANT NOTICE AT BOTTOM OF THESE INSTRUCTIONS !! INITIAL PROCEDURE TO ALLOW YOU TO CHANGE YOUR PASSWORD ON THE UD NETWORK : 1. In your web browser, enter http://mycampus.dbq.edu . If you are logging in for the first time, you will be directed to answer (3) security questions. Also, be sure to answer one of the recovery methods. 2. Once the questions are answered, you will click on SUBMIT and then CONTINUE and then YES. 3. In one location, you will now find MyUD, Campus Portal, Email and UDOnline (Moodle). 4. You can now click on any of these apps and you will be logged in already. The email link will prompt you for the password a second time until we get all accounts set up properly. YOU MUST BE SURE TO LOGOUT OF EACH APPLICATION AFTER YOU’RE DONE USING IT !! TO CHANGE YOUR PASSWORD: 1. After you have logged into the MyCampus.dbq.edu website, you will see your username in the upper- right corner of the screen. 2. Click on your name and then go into My Account. 3. At the bottom, you will click on Change Password and then proceed as directed. 4. You can now logout. You will need to use your new password on your next login. Password must be a minimum of 6 characters and contain 3 of the following 4 categories: - Uppercase character - Lowercase character - Number - Special character You cannot use the previous password You’ll be required to change your password every 180 days.
    [Show full text]
  • Reset Forgotten Password with Office365
    RESET FORGOTTEN PASSWORD 1. Go to https://login.microsoftonline.com 2. Click the link “Can’t access your account?” 3. Select Work or School account 4. Enter in your User ID with the @uamont.edu at the end and then enter the characters as seen in the picture. You can click the refresh button for a different set of letters. 5. You will have 3 options to verify your account and reset your password. This information was set up when you registered with self-service password reset. If you have not registered, please go to https://aka.ms/ssprsetup and enter in your information. A step by step guide on how to do this can be found here. a. Text your mobile phone b. Call your mobile phone c. Answer Security Questions 6. Choose one option and enter the information requested 7. Click Text for text my mobile phone, Call for call my mobile phone, or click Next when you’ve answered all security questions. a. If you have selected Text my mobile phone you will be required to enter in a verification code and click Next b. If you have select Call my mobile phone you will receive a call and will need to enter # to verify. 8. Enter in your new password and click Finish a. Note: If you receive the message, “Unfortunately, your password contains a word, phrase, or pattern that makes it easily guessable. Please try again with a different password.” Please try to create a password that does not use any dictionary words. b. Passwords must meet 3 of the 4 following requirements i.
    [Show full text]
  • A Comparison of Natural Language Understanding Platforms for Chatbots in Software Engineering
    1 A Comparison of Natural Language Understanding Platforms for Chatbots in Software Engineering Ahmad Abdellatif, Khaled Badran, Diego Elias Costa, and Emad Shihab, Senior Member, IEEE Abstract—Chatbots are envisioned to dramatically change the future of Software Engineering, allowing practitioners to chat and inquire about their software projects and interact with different services using natural language. At the heart of every chatbot is a Natural Language Understanding (NLU) component that enables the chatbot to understand natural language input. Recently, many NLU platforms were provided to serve as an off-the-shelf NLU component for chatbots, however, selecting the best NLU for Software Engineering chatbots remains an open challenge. Therefore, in this paper, we evaluate four of the most commonly used NLUs, namely IBM Watson, Google Dialogflow, Rasa, and Microsoft LUIS to shed light on which NLU should be used in Software Engineering based chatbots. Specifically, we examine the NLUs’ performance in classifying intents, confidence scores stability, and extracting entities. To evaluate the NLUs, we use two datasets that reflect two common tasks performed by Software Engineering practitioners, 1) the task of chatting with the chatbot to ask questions about software repositories 2) the task of asking development questions on Q&A forums (e.g., Stack Overflow). According to our findings, IBM Watson is the best performing NLU when considering the three aspects (intents classification, confidence scores, and entity extraction). However, the results from each individual aspect show that, in intents classification, IBM Watson performs the best with an F1-measure>84%, but in confidence scores, Rasa comes on top with a median confidence score higher than 0.91.
    [Show full text]